{"id":51892077,"url":"https://github.com/circlefin/arc-remote-signer","last_synced_at":"2026-07-26T05:01:44.464Z","repository":{"id":365789523,"uuid":"1190248388","full_name":"circlefin/arc-remote-signer","owner":"circlefin","description":"Secure remote signing service for Arc Network using AWS Nitro Enclaves","archived":false,"fork":false,"pushed_at":"2026-06-18T21:38:52.000Z","size":216,"stargazers_count":6,"open_issues_count":3,"forks_count":7,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-06-18T23:20:33.560Z","etag":null,"topics":["arc","blockchain","golang","nitro-enclaves","signing"],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/circlefin.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":"SECURITY.md","support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2026-03-24T05:16:46.000Z","updated_at":"2026-06-18T21:38:57.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/circlefin/arc-remote-signer","commit_stats":null,"previous_names":["circlefin/arc-remote-signer"],"tags_count":3,"template":false,"template_full_name":null,"purl":"pkg:github/circlefin/arc-remote-signer","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/circlefin%2Farc-remote-signer","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/circlefin%2Farc-remote-signer/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/circlefin%2Farc-remote-signer/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/circlefin%2Farc-remote-signer/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/circlefin","download_url":"https://codeload.github.com/circlefin/arc-remote-signer/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/circlefin%2Farc-remote-signer/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":35901460,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-07-20T02:08:10.276Z","status":"online","status_checked_at":"2026-07-26T02:00:06.503Z","response_time":89,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["arc","blockchain","golang","nitro-enclaves","signing"],"created_at":"2026-07-26T05:01:44.398Z","updated_at":"2026-07-26T05:01:44.457Z","avatar_url":"https://github.com/circlefin.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Arc Remote Signer\n\nSecure cryptographic signing service for Arc Chain validators, powered by AWS Nitro Enclaves — also known as **Nitro Enclave Signer**.\n\n![Go Version](https://img.shields.io/badge/go-1.25-blue)\n\n---\n\n## Overview\n\nArc Remote Signer is a gRPC microservice designed specifically for Arc Chain validators, providing cryptographic key generation and signing operations with hardware-level security guarantees from AWS Nitro Enclaves. The service implements a dual-process architecture where a Proxy (outside the enclave) handles incoming requests while the Enclave (inside Nitro Enclave) performs all cryptographic operations.\n\nTraditional key management systems store private keys in memory, making them vulnerable to compromise from privileged users, malware, or system vulnerabilities. Arc Remote Signer addresses these risks by isolating all cryptographic operations inside an AWS Nitro Enclave—a hardware-backed trusted execution environment with cryptographic attestation capabilities.\n\nDeployed as a 1-to-1 sidecar alongside Arc Chain validator nodes, Arc Remote Signer provides verifiable proof that signing operations occur within a secure enclave, enabling zero-trust architectures where even the host system cannot access private key material.\n\n## Features\n\n- 🔐 **Hardware-isolated operations** - Validator key operations isolated in AWS Nitro Enclaves\n- 🔑 **Ed25519 signatures** - Primary signing algorithm for Arc Chain validators with BLS support\n- 📜 **Cryptographic attestation** - Verifiable proof of enclave execution for validator operations\n- 🔄 **Envelope encryption** - Four-layer key protection (validator key → data key → KMS key → enclave key)\n- 🚀 **High-performance gRPC** - Efficient binary protocol for low-latency validator signing\n- 📊 **Full observability** - OpenTelemetry tracing, Datadog metrics, and an optional Prometheus endpoint\n- 🏗️ **Sidecar architecture** - 1-to-1 deployment alongside Arc Chain validator nodes\n- ✅ **Comprehensive testing** - Unit, integration, and smoke test coverage\n\n## Quick Start\n\nGet the service running locally in 3 steps:\n\n### Prerequisites\n\n- Go 1.25+\n- Docker and Docker Compose\n- Make\n\n### Installation\n\n```bash\n# 1. Clone the repository\ngit clone https://github.com/circlefin/arc-remote-signer.git\ncd arc-remote-signer\n\n# 2. Install pre-commit hooks\nbrew install go pre-commit\npre-commit install\n\n# 3. Start the development environment\nmake dev\n```\n\nThe service will start on the default gRPC port with all dependencies running in Docker.\n\n### Verify Installation\n\n```bash\n# Run smoke tests to verify everything works\nmake smoke\n```\n\nIf all tests pass, the service is ready to use!\n\n## Documentation\n\n- [`docs/architecture.md`](./docs/architecture.md) — dual-process architecture, runtime flows, security model, deployment, API reference, troubleshooting\n- [`docs/development.md`](./docs/development.md) — prerequisites, build/run commands, coding conventions, pre-commit hooks\n- [`docs/testing.md`](./docs/testing.md) — test matrix and conventions\n\n## Architecture\n\nArc Remote Signer uses a **dual-process architecture** with clear security boundaries between the Proxy (outside enclave) and Enclave (inside Nitro Enclave):\n\n```\n┌─────────────────────────────────────────────────────────────┐\n│                  Arc Chain Validator                        │\n└───────────────────────────┬─────────────────────────────────┘\n                            │ gRPC (sidecar)\n                            ▼\n┌─────────────────────────────────────────────────────────────┐\n│                      Proxy (Host)                           │\n│  ┌──────────────┐  ┌──────────────┐  ┌──────────────┐       │\n│  │   gRPC API   │  │   Signer     │  │  Providers   │       │\n│  │   Handlers   │─▶│   Service    │─▶│ (KMS, Secrets│       │\n│  └──────────────┘  └──────────────┘  │  Manager)    │       │\n│                            │         └──────────────┘       │\n│                            │ vsock/gRPC                     │\n└────────────────────────────┼────────────────────────────────┘\n                             │\n                ┌────────────▼────────────┐\n                │   Nitro Enclave         │\n                │  ┌──────────────────┐   │\n                │  │  Enclave gRPC    │   │\n                │  │    Handlers      │   │\n                │  └────────┬─────────┘   │\n                │           │             │\n                │  ┌────────▼─────────┐   │\n                │  │  Key Decryption  │   │\n                │  │  \u0026 Signing       │   │\n                │  └────────┬─────────┘   │\n                │           │             │\n                │  ┌────────▼─────────┐   │\n                │  │  NSM Attestation │   │\n                │  └──────────────────┘   │\n                └─────────────────────────┘\n```\n\n### Key Components\n\n1. **Proxy** (`internal/app/`) - Runs outside the enclave, handles validator signing requests, manages AWS integrations (KMS for key decryption, Secrets Manager for configuration), caches attestation documents, and proxies signing operations to the enclave over vsock.\n\n2. **Enclave** (`internal/enclave/`) - Runs inside an AWS Nitro Enclave, performs all cryptographic operations (key decryption, validator signing), maintains secure key material in memory, and generates attestation documents proving execution within the secure environment.\n\n3. **Communication Layer** - Proxy and enclave communicate via gRPC over vsock (virtual socket), ensuring type-safe, versioned contracts between trust boundaries. Validator nodes communicate with the Proxy via standard gRPC.\n\nFor detailed layer architecture and shared infrastructure, see [`docs/architecture.md`](./docs/architecture.md).\n\n## Usage\n\nArc Remote Signer exposes a gRPC API for Arc Chain validators to perform signing operations:\n\n### SignerService API\n\n**SignerService** is the **public API** exposed by the Proxy for Arc Chain validators:\n\n- **Port**: 10340 (external, accessible from validator nodes)\n- **Proto**: `proto/arc/signer/v1/signer.proto`\n- **Methods**: `PublicKey()`, `Sign()`\n- **Use case**: Arc Chain validators that need simple signing without managing key material directly\n\nThis simplified API abstracts away key management complexity, allowing validators to request public keys and signatures without handling encrypted key material.\n\n### Example: Validator Integration\n\nThis example shows how Arc Chain validators interact with the service:\n\n```go\npackage main\n\nimport (\n    \"context\"\n    \"log\"\n\n    pb \"github.com/circlefin/arc-remote-signer/proto/pb\"\n    \"google.golang.org/grpc\"\n    \"google.golang.org/grpc/credentials/insecure\"\n)\n\nfunc main() {\n    // Connect to the service\n    conn, err := grpc.NewClient(\"localhost:10340\",\n        grpc.WithTransportCredentials(insecure.NewCredentials()))\n    if err != nil {\n        log.Fatal(err)\n    }\n    defer conn.Close()\n\n    client := pb.NewSignerServiceClient(conn)\n    ctx := context.Background()\n\n    // Get the public key\n    pubKeyResp, err := client.PublicKey(ctx, \u0026pb.PublicKeyRequest{})\n    if err != nil {\n        log.Fatalf(\"PublicKey failed: %v\", err)\n    }\n    log.Printf(\"Public key: %x\", pubKeyResp.PublicKey)\n\n    // Sign a message\n    signResp, err := client.Sign(ctx, \u0026pb.SignRequest{\n        Message: []byte(\"message to sign\"),\n    })\n    if err != nil {\n        log.Fatalf(\"Sign failed: %v\", err)\n    }\n    log.Printf(\"Signature: %x\", signResp.Signature)\n}\n```\n\n### EnclaveService API (Internal)\n\n**EnclaveService** is an **internal API** inside the Nitro Enclave, **not accessible to external clients**:\n\n- **Port**: 10350 (internal vsock only, accessible only by Proxy)\n- **Proto**: `proto/arc/enclave/v1/enclave.proto`\n- **Methods**: `GenerateKey()`, `GetPublicKey()`, `SignMessage()`, `GetAttestation()`\n- **Use case**: Internal communication between Proxy and Enclave over vsock\n\nThis full-featured API is used exclusively by the Proxy to communicate with the Enclave for cryptographic operations. Arc Chain validators do not interact with this API directly. The EnclaveService handles key generation, encrypted key material management, signing operations, and attestation document generation—all within the secure enclave environment.\n\n## Deployment\n\nArc Remote Signer is deployed as a 1-to-1 sidecar with Arc Chain validator nodes on Nitro-enabled AWS EC2 instances.\n\n## Reproducible Enclave Builds\n\nThe enclave Docker image is built reproducibly — identical source produces bit-for-bit identical images across builds. This ensures the PCR0 hash (derived from the enclave image) is stable and predictable, which is critical for attestation policy.\n\nThe enclave build uses a dedicated `docker/Dockerfile.enclave`, separate from the main `docker/Dockerfile` used by the signer targets. Key techniques:\n- **Digest-pinned base images** (Go toolchain + Debian)\n- **Snapshot-pinned apt** via `snapshot.debian.org` for deterministic packages\n- **In-Docker Go build** with `-trimpath -buildvcs=false -ldflags=-buildid=`\n- **Timestamp clamping** via `SOURCE_DATE_EPOCH` and targeted `find/touch`\n- **Bind mounts** instead of `COPY` to avoid wall-clock layer timestamps\n\nTo verify locally:\n\n```bash\nmake test-reproducibility\n```\n\n\u003e **Note:** Updating any digest pin in `docker/Dockerfile.enclave` will change the enclave image and invalidate existing PCR hashes. See the warning in the Dockerfile header.\n\n## Development\n\nThis project uses `make` targets as the standard workflow entry points. For full command details, conventions, and pre-commit hooks, see [`docs/development.md`](./docs/development.md).\n\n### Project Structure\n\n```\n.\n├── cmd/                    # CLI entry points\n├── internal/\n│   ├── app/               # Proxy (outside enclave)\n│   │   ├── public/        # gRPC handlers\n│   │   ├── service/       # Business logic\n│   │   └── provider/      # AWS integrations (KMS, Secrets Manager)\n│   ├── enclave/           # Enclave (inside Nitro Enclave)\n│   │   ├── public/        # Enclave gRPC handlers\n│   │   ├── service/       # Enclave business logic\n│   │   └── provider/      # Key storage, attestation\n│   ├── common/            # Shared infrastructure\n│   │   ├── crypto/        # AES, random generation\n│   │   ├── grpc/          # gRPC client/server/interceptors\n│   │   ├── logging/       # Structured logging\n│   │   ├── metric/        # Datadog metrics\n│   │   └── telemetry/     # OpenTelemetry\n│   └── smoke/             # End-to-end smoke tests\n├── proto/                 # Protocol buffers\n│   ├── arc/signer/v1/     # SignerService (external API)\n│   └── arc/enclave/v1/    # EnclaveService (internal API)\n├── docker/                # Docker build configuration\n├── deployments/           # Docker Compose (localstack)\n└── scripts/               # Build and utility scripts\n```\n\n## Security Model\n\nArc Remote Signer protects validator keys using Nitro Enclave isolation, envelope encryption, and attestation-backed key access controls.\n\n## API Reference\n\nArc Remote Signer exposes:\n\n- `SignerService` (public API): `proto/arc/signer/v1/signer.proto`\n- `EnclaveService` (internal API): `proto/arc/enclave/v1/enclave.proto`\n\n## Troubleshooting\n\nSee the troubleshooting section in [`docs/architecture.md`](./docs/architecture.md#troubleshooting).\n\n## Contributing\n\nWe welcome bug reports and feature requests via [GitHub Issues](../../issues).\nCircle maintains this project and will address issues at our discretion.\n\nFor security issues, please refer to our [Security Policy](./SECURITY.md) instead of opening a public issue.\n\n## License\n\nCopyright © 2026 Circle Internet Group\n\nLicensed under the Apache License, Version 2.0. See http://www.apache.org/licenses/LICENSE-2.0 for details.\n\n### Dependencies\n\nThis project includes dependencies under various open-source licenses:\n\n- **gRPC** - Apache 2.0\n- **Protocol Buffers** - BSD 3-Clause\n- **AWS SDK for Go** - Apache 2.0\n- **OpenTelemetry** - Apache 2.0\n- **Testify** - MIT\n- **GoMock** - Apache 2.0\n\nFor a complete list of dependencies:\n```bash\ngo list -m all\n```\n\n## Acknowledgments\n\n### Project Team\n\nThis project was developed by the Circle engineering team.\n\n### Resources \u0026 References\n\n**AWS Nitro Enclaves Documentation**:\n- [AWS Nitro Enclaves](https://docs.aws.amazon.com/enclaves/latest/user/nitro-enclave.html)\n- [Nitro System Manager Documentation](https://docs.aws.amazon.com/enclaves/latest/user/set-up-nitro-enclave-dev-environment.html)\n- [Attestation Document Format](https://docs.aws.amazon.com/enclaves/latest/user/verify-root.html)\n\n**Cryptography References**:\n- [Ed25519 Signature Scheme](https://ed25519.cr.yp.to/)\n- [BLS Signatures](https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-bls-signature)\n\n**Go \u0026 gRPC Ecosystem**:\n- [Go Project](https://golang.org/)\n- [gRPC Documentation](https://grpc.io/docs/)\n- [Protocol Buffers](https://developers.google.com/protocol-buffers)\n- [Buf](https://buf.build/) - Protocol buffer management\n\n**Security \u0026 Best Practices**:\n- [Zero Trust Architecture](https://www.nist.gov/publications/zero-trust-architecture)\n- [Confidential Computing Consortium](https://confidentialcomputing.io/)\n\n### Support\n\nFor questions, issues, or discussions:\n- **GitHub Issues**: Report bugs and request features\n- **Documentation**: See [`docs/architecture.md`](./docs/architecture.md) for architecture and [`docs/development.md`](./docs/development.md) for development guidelines\n\n---\n\n**Ready to get started?** See the [Quick Start](#quick-start) section for installation instructions.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcirclefin%2Farc-remote-signer","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fcirclefin%2Farc-remote-signer","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcirclefin%2Farc-remote-signer/lists"}